AI Agents Are Moving Like Your Customers

​Benjamin Fabre is the cofounder and CEO of DataDome.

For years, bot defense was simple. You stopped bad actors at the door and let real customers through. That worked when bots were mostly crawlers that scraped your homepage and moved on.​

But that’s not the case anymore. According to my company’s “State of Bot & Agent Security Report, 2026,” “AI agents generated 605.6 million requests to high-risk endpoints” across our customer base in just the first half of 2026. We’re not talking about home pages or blog posts. AI agents are showing up on login pages, checkout and payment flows and account-creation forms, following the same paths as your customers.​

From Crawlers To Customers

AI traffic used to be passive and operated much like a search engine crawler. Now AI agents complete the same multistep actions that used to require a person at a keyboard.​

Monthly AI bot requests to login pages grew more than eight times in six months. Login pages made up 51.7% of all high-risk AI traffic in the first half of 2026, up from 23% a year earlier. That means your login page, not your homepage, is now the busiest AI entry point into your business.

The Authentication Problem

Login pages exist for a reason. They guard order history, saved payment methods and loyalty balances. A legitimate AI shopping assistant checking on a delivery has to log in somewhere, and that’s a valid use case.​

But the same login page is just as attractive to a fraudster attempting credential stuffing or account takeover. The action looks identical, but the intent isn’t. That jump in login traffic could be legitimate agentic commerce, credential attacks or both at once. Block everything, and you shut out your own customers’ tools. Wave everything through, and you hand attackers an opening. Neither works. ​